In accordance with the General Data Protection Regulation ("GDPR"), and Spanish Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights ("LOPDGDD"), Intermodalidad de Levante, S.A. (hereinafter, "IRYO" or "the Data Controller") (A98728611) provides you with this Privacy Policy to inform you in a clear and transparent manner of how we collect and process your personal data, both through the Website www.iryo.eu ("the Website"), and its present and future sub-domains.
IRYO, whose head offices are located at Calle de Méndez Álvaro, 56, 28045, Madrid, Spain, is the Data Controller responsible for the processing of your personal data collected through the Website. You may contact us through our email address: protecciondedatos@iryo.eu
| When? | For what reason? | Legal basis | What data? | For how long? |
|---|---|---|---|---|
| When you register as a user on our online platform | Register on our online platform (whether you are a travel agency or an end user) so that you can manage your purchases and tickets more easily. | Art. 6.1.a) GDPR: Express consent. |
Name and surname, National Identification Document, email address, telephone number, date of birth, postal address. | As long as you do not withdraw your consent. |
| When you purchase a ticket as a registered user | Management of the journey purchased. | Art. 6.1.b) Contractual relationship. |
Name and surname, email address, postal address, telephone number, payment details. | For the duration of the legal obligations arising from the contractual relationship. |
| When you buy a ticket without registering | Management of the journey purchased. | Art. 6.1.b) Contractual relationship. |
Name and surname, email address, postal address, telephone number, payment details. | For the duration of the legal obligations arising from the contractual relationship. |
| When you sign up for our loyalty programme | Send you discounts, exclusive offers and regular newsletters. | Art. 6.1.a) GDPR: Express consent. |
Name and surname, National Identification Document, email address, telephone number, date of birth, postal address. | As long as you do not withdraw your consent. |
| When you sign up for the Newsletter | To send you commercial communications by electronic means, as well as to manage your subscription. | Art. 6.1.a) GDPR: Express consent. |
Name, email address. | As long as you do not withdraw your consent. |
| When we obtain information about your profile based on your purchases and preferences. | Offer you products based on your previous purchases and interaction with IRYO. | Art. 6.1.f) GDPR: Legitimate interest of IRYO. |
Name and surname, chosen ticket fare, extras booked. | Until such time as you object to the processing. |
| When you contact customer service | Resolve your doubts, queries or questions related to IRYO. | Art. 6.1.f) GDPR: Legitimate interest of IRYO. |
Name and surname, contact details by email, by telephone, details of the trip contracted. | Until such time as you object to the processing. |
| When you write to us via the "Contact" form | To attend to and respond to your queries and/or suggestions. | Art. 6.1.a) GDPR: Express consent. |
Name, surname and email address. | As long as you do not withdraw your consent. |
| When accessing our trains and video-monitored facilities | Maintaining the security of our facilities | Art. 6.1.f) GDPR: Legitimate interest of IRYO. |
Data on physical characteristics captured by cameras. | 30 days unless legal obligations arise. |
| When you participate in our contests and draws | Manage your participation in IRYO competitions and draws. | Art. 6.1.a) GDPR: Express consent. |
Name and surname, email address, postal address. | As long as you do not withdraw your consent. |
| When you access our social media profiles | To provide you with information through these platforms, to improve your browsing experience and to compile statistics. | Art. 6.1.a) GDPR: Express consent. |
Information collected using Cookies: IP address, device and browser data, social media username. | As long as you do not withdraw your consent. |
| When you use the WIFI service on board our trains | Offer you the WIFI service on board our trains. | Art. 6.1.a) GDPR: Express consent. |
Name and surname, email, device identifiers (IP address, device type, connection time), browsing data. | As long as you do not withdraw your consent. |
| When you access and browse the Website | Improving the browsing experience through Cookies, which you can consult in our Cookies Policy. | Art. 6.1.a) GDPR: Express consent. |
IP address, browser data, information on cookies. | As long as you do not withdraw your consent. |
| When you send us your CV through the channels provided for this purpose, "Join us" and other ways | Manage your request and your interest in contacting IRYO and its partners | Art. 6.1.a) GDPR: Express consent. |
Professional and contact details. Identification details. | 2 years from receipt of your CV. |
The information that we collect about our users through our website is given to us both directly and indirectly via browsing.
Through browsing, it is possible to collect information on the habits and behaviour of users within the Website. This data is collected through the installation of cookies or other similar devices, as explained in our Política de Cookies.
Furthermore, in the event that you have decided to purchase your trip with us through a Travel Agency, we inform you that IRYO has had access to them through the Agency.
All fields marked with an asterisk (*) on the forms are compulsory. Failure to complete any of these fields could make it impossible to provide the services requested. Users must provide truthful information, and impersonation or the use of aliases or anonymous names within the contact form is prohibited.
So that the information provided is always up to date and does not contain errors, the Client must inform IRYO, as soon as possible, of any changes to their personal data that may occur by sending an email to the following address protecciondedatos@iryo.eu.
By clicking on the "I accept" button (or equivalent) incorporated in the aforementioned forms, as a user you declare that the information and data you have provided are accurate and truthful.
We collect the information you provide when you contact us through the channels provided for this purpose, such as the contact form located at the bottom of our website, www.iryo.eu and the aforementioned subdomains to which this Privacy Policy applies.
When you contact us through these channels, we ask for your email address, your first and last name, the company you represent or a telephone number.
With regard to the use and enjoyment of the services integrated within the website, we process the identification data lawfully provided by the users themselves in order to be able to offer the service offered, in particular the registration of those interested in the different calls, projects and programmes that IRYO coordinates and manages.
As with the data you provide us with through the contact forms, the identification data are presumed to be true, lawful, accurate and certain, and IRYO shall not be held responsible for any inaccuracy or possible fraud that may arise from the inappropriate use of our platforms on the part of Users.
The data collected by IRYO through these forms and attached to the pages and various service areas of the Website are the minimum details necessary to facilitate the service, to establish an optimal level of functionality and ensure that the object of the end users' request is provided. These data are collected directly from users, through the forms and identification information fields necessary to develop the services offered within the Website.
The data on the use of the platforms developed by IRYO may be used to evaluate the correct functioning of all their features, as well as to be able to improve the services we offer. Appropriate technical and physical security measures have been taken to protect this information.
When you buy our tickets and decide to travel with us, you are contracting the most cutting-edge services and offers in the sector. In order to provide you with the best possible service, we will sometimes need to share your details with our partners.
In the event that you are a passenger requiring special on-board assistance or care related to a situation of reduced mobility, it will be necessary for us to communicate your details to the public company Administrador de Infraestructuras Ferroviarias (ADIF), which will be responsible for providing you with the assistance service for boarding and departure of the train. You can consult the Privacy Policy at Data Protection - ADIF
In the event that, due to a breakdown or failure of a train for which you have purchased a ticket, it is not possible for you to board it, your details may be communicated, if you so wish, to OUIGO ESPAÑA, S.A. or to RENFE VIAJEROS SOCIEDAD MERCANTIL ESTATAL, S.A., so that it is possible to offer you an alternative to your cancelled journey on a train operated by one of these two companies.
Thus, in order to correctly manage the service that you contract, it will also be necessary for us to communicate your data to payment platforms that will manage the purchase data, these payment platforms may include
In addition, in the event that you contract catering services on board trains and inform us of your food preferences, this information must be communicated to GATE GOURMET SWITZERLAND GMBH so that company can provide you with the service you have requested.
Other than in these cases, we will not share your personal data except at the request of judicial and/or administrative authorities, law enforcement agencies, or to comply with legal obligations. We also do not make international transfers to countries outside the European Economic Area (EEA).
On the basis of our legitimate interest, we will process your personal data to create a buyer profile on the basis of which we can determine which services and offers may be of most interest to you. To build this business profile, analytical models will be applied to gain a deeper understanding of your travel preferences and the type of trips you take. For this purpose, in addition to the data analysed in the basic commercial profile, we use data such as the price ranges of the trains you purchase or the extra services you purchase as add-ons.
Thus, your data will be processed in order to offer you selected information about IRYO's services when we show you advertising or when we periodically send you personalised offers through commercial communications, so that the information they contain is relevant and can provide you with the maximum benefits.
You may object to this processing at any time by sending a letter with the subject "Exercise of rights" to the following email address protecciondedatos@iryo.eu or to the address Calle de Méndez Álvaro, 56, 28045, Madrid, Spain. Personal data provided for profiling and authorised by the data subject shall be retained until we are informed of your objection to such processing, without prejudice to your right to erasure or opposition.
IRYO shall process the personal data of those who access the train, or the company's physical sales offices, in order to ensure the security of persons, goods and facilities.
The legal basis allowing IRYO to process the data is its legitimate interest in the security of trains, as well as that of all persons on them.
Images obtained via video surveillance systems shall be kept for a maximum period of one (1) month from the time they were captured. Once this period has elapsed, they will generally be deleted, except if it is necessary to keep them in order to comply with any legal provision, administrative and/or judicial requirement or exceptional situation that legitimises the conservation of the recordings for a period of time longer than that established by law.
The User enjoys the following rights in relation to the processing of personal data:
These rights can be exercised by sending an email to protecciondedatos@iryo.eu or by writing to Calle de Méndez Álvaro, 56, 28045, Madrid, Spain, indicating "Exercise of rights" as the subject.
In the event that you consider that there have been irregularities in the processing of your personal data, you may lodge a complaint by writing to the Spanish Data Protection Agency at Calle Jorge Juan, 6 28001, Madrid or at the electronic headquarters https://sedeagpd.gob.es.
Date of last version: September 2022